Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    104s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/04/2023, 17:48

General

  • Target

    97e08219837f3e3e3f3dc2edeeb281697fca0c31ee35c6845b5d6982fbe3b769.exe

  • Size

    1.1MB

  • MD5

    3bc2f23f4b79eec2ace7389de491795e

  • SHA1

    b4b05a8390a68c7af5738f38fc817aae861ee8c9

  • SHA256

    97e08219837f3e3e3f3dc2edeeb281697fca0c31ee35c6845b5d6982fbe3b769

  • SHA512

    851dc1714a378ebd944a49b86116c86a1e7f5725ef75924ffc0132bf4f3391534b7242f73fdee4dad64def976bb10282c7d4057d3a170a8994bfd9bf6965eaf2

  • SSDEEP

    24576:My+GEggJ7W/jMjiBk6n3Nw+9pPaVEA8FZDC7HYvSIN+NZfTL:7+BkjMo3NwSQEFZQYpN+NxT

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

C2

185.161.248.90:4125

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97e08219837f3e3e3f3dc2edeeb281697fca0c31ee35c6845b5d6982fbe3b769.exe
    "C:\Users\Admin\AppData\Local\Temp\97e08219837f3e3e3f3dc2edeeb281697fca0c31ee35c6845b5d6982fbe3b769.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421521.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421521.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un072900.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un072900.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr721059.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr721059.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3944
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu765473.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu765473.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1980
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4260
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk823693.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk823693.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3500
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si365152.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si365152.exe
      2⤵
      • Executes dropped EXE
      PID:3812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 628
        3⤵
        • Program crash
        PID:4188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 704
        3⤵
        • Program crash
        PID:4956
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 840
        3⤵
        • Program crash
        PID:4596
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 852
        3⤵
        • Program crash
        PID:3592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 880
        3⤵
        • Program crash
        PID:3512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 904
        3⤵
        • Program crash
        PID:3804
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 1076
        3⤵
        • Program crash
        PID:3228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si365152.exe

    Filesize

    395KB

    MD5

    1d6ceca43b63d4a05a546644f680f28e

    SHA1

    c7b606759ed3c69d4288a6524fb4a42e439785da

    SHA256

    fde652c054954e5003a3c37ab2aa83e8a3305018b0f3ef5c0b29784af088256c

    SHA512

    8a8ea47baf07e59c2e62af762ac8b660ef4651ad01cdf810e965f807b0d0ec8e4dbf1f02cbcc8d1000491834a86224bee793b260cedd57815f703ee0fd6a735b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si365152.exe

    Filesize

    395KB

    MD5

    1d6ceca43b63d4a05a546644f680f28e

    SHA1

    c7b606759ed3c69d4288a6524fb4a42e439785da

    SHA256

    fde652c054954e5003a3c37ab2aa83e8a3305018b0f3ef5c0b29784af088256c

    SHA512

    8a8ea47baf07e59c2e62af762ac8b660ef4651ad01cdf810e965f807b0d0ec8e4dbf1f02cbcc8d1000491834a86224bee793b260cedd57815f703ee0fd6a735b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421521.exe

    Filesize

    853KB

    MD5

    a0ef6339725ef2338655fd5a0b8b22cd

    SHA1

    38f14590e85fcf75396397a41f3525b4119204b2

    SHA256

    d9d076be4cce88077d73287a14a443a09f4d51b43535fde9de51358880e2b9dd

    SHA512

    a148a2ec6ef8253e956b75409faead11c7a38e86d4357f88c734a3706583803e344e41560d16c950fa8d6a536f00276092f677fa86a37aaa3864304b1b5a0727

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421521.exe

    Filesize

    853KB

    MD5

    a0ef6339725ef2338655fd5a0b8b22cd

    SHA1

    38f14590e85fcf75396397a41f3525b4119204b2

    SHA256

    d9d076be4cce88077d73287a14a443a09f4d51b43535fde9de51358880e2b9dd

    SHA512

    a148a2ec6ef8253e956b75409faead11c7a38e86d4357f88c734a3706583803e344e41560d16c950fa8d6a536f00276092f677fa86a37aaa3864304b1b5a0727

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk823693.exe

    Filesize

    168KB

    MD5

    c52ebada00a59ec1f651a0e9fbcef2eb

    SHA1

    e1941278df76616f1ca3202ef2a9f99d2592d52f

    SHA256

    35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

    SHA512

    6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk823693.exe

    Filesize

    168KB

    MD5

    c52ebada00a59ec1f651a0e9fbcef2eb

    SHA1

    e1941278df76616f1ca3202ef2a9f99d2592d52f

    SHA256

    35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

    SHA512

    6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un072900.exe

    Filesize

    699KB

    MD5

    79aabd589b8fa22b304b03d3cb0b9de4

    SHA1

    5aadb2c7ba23a9f2ec159d5b278e865a83aab9f1

    SHA256

    caaedc0fbb9ac2111923b3d8dc7a7e0af0ebd8f39a4c98ec8007cac180e92d6b

    SHA512

    aea5483bcb5f8e6dc5509d09ca48df1469fcb397a687ef9c7fbcdae65032a938035b792d09def47216eab04b3221a0ef9c2b6c8ab6f3a3e98b2fd8dcedc24bcf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un072900.exe

    Filesize

    699KB

    MD5

    79aabd589b8fa22b304b03d3cb0b9de4

    SHA1

    5aadb2c7ba23a9f2ec159d5b278e865a83aab9f1

    SHA256

    caaedc0fbb9ac2111923b3d8dc7a7e0af0ebd8f39a4c98ec8007cac180e92d6b

    SHA512

    aea5483bcb5f8e6dc5509d09ca48df1469fcb397a687ef9c7fbcdae65032a938035b792d09def47216eab04b3221a0ef9c2b6c8ab6f3a3e98b2fd8dcedc24bcf

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr721059.exe

    Filesize

    403KB

    MD5

    cb6cb18651b864b90ceae4f3469101f9

    SHA1

    f7bc16fd7b770848322a1cf8a9d3af17d4b4f518

    SHA256

    74a10428f5a1ce95ad58c3cee761eae5fbb95f64bc7d0bef14bfcb9dd5171b29

    SHA512

    e7d25ed10ab78e65d951cc74fd450555bf8ee5f237dc842c455e0919403610044c238aaf40c97cb2d20d84ee584148bb65ea30f48c4dd99923e5dd4da73ab832

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr721059.exe

    Filesize

    403KB

    MD5

    cb6cb18651b864b90ceae4f3469101f9

    SHA1

    f7bc16fd7b770848322a1cf8a9d3af17d4b4f518

    SHA256

    74a10428f5a1ce95ad58c3cee761eae5fbb95f64bc7d0bef14bfcb9dd5171b29

    SHA512

    e7d25ed10ab78e65d951cc74fd450555bf8ee5f237dc842c455e0919403610044c238aaf40c97cb2d20d84ee584148bb65ea30f48c4dd99923e5dd4da73ab832

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu765473.exe

    Filesize

    588KB

    MD5

    602b8d702d6eacd5942dfc8da6108d15

    SHA1

    17144cfa28563db9cd0deecb5e7f9c15d13d2d7f

    SHA256

    5691b3b8dd7acfb76eba9e509031db0064d59f912b63c55c0830af63f3862b54

    SHA512

    5eb5a8c0e149ff257f795450d5d04a046a01b2bba92eb3759a07fbe02584f1a3f756a992474d1a23a5cc7e7635a96fc7cd001f23221fe31e03869fa5d17ac82d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu765473.exe

    Filesize

    588KB

    MD5

    602b8d702d6eacd5942dfc8da6108d15

    SHA1

    17144cfa28563db9cd0deecb5e7f9c15d13d2d7f

    SHA256

    5691b3b8dd7acfb76eba9e509031db0064d59f912b63c55c0830af63f3862b54

    SHA512

    5eb5a8c0e149ff257f795450d5d04a046a01b2bba92eb3759a07fbe02584f1a3f756a992474d1a23a5cc7e7635a96fc7cd001f23221fe31e03869fa5d17ac82d

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/1980-215-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-201-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-220-0x0000000004FF0000-0x0000000005000000-memory.dmp

    Filesize

    64KB

  • memory/1980-218-0x0000000000A00000-0x0000000000A5B000-memory.dmp

    Filesize

    364KB

  • memory/1980-193-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-211-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-213-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-209-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-207-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-205-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-203-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-217-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-199-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-197-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-195-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-221-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-2330-0x0000000004FB0000-0x0000000004FE2000-memory.dmp

    Filesize

    200KB

  • memory/1980-184-0x00000000028D0000-0x0000000002938000-memory.dmp

    Filesize

    416KB

  • memory/1980-185-0x0000000002780000-0x00000000027E6000-memory.dmp

    Filesize

    408KB

  • memory/1980-186-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-187-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-189-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/1980-191-0x0000000002780000-0x00000000027E0000-memory.dmp

    Filesize

    384KB

  • memory/3500-2344-0x0000000000CF0000-0x0000000000CF6000-memory.dmp

    Filesize

    24KB

  • memory/3500-2343-0x00000000004D0000-0x0000000000500000-memory.dmp

    Filesize

    192KB

  • memory/3500-2358-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/3500-2357-0x000000000B380000-0x000000000B3D0000-memory.dmp

    Filesize

    320KB

  • memory/3500-2354-0x000000000AD90000-0x000000000ADF6000-memory.dmp

    Filesize

    408KB

  • memory/3500-2353-0x000000000AE30000-0x000000000AEC2000-memory.dmp

    Filesize

    584KB

  • memory/3500-2352-0x000000000A680000-0x000000000A6F6000-memory.dmp

    Filesize

    472KB

  • memory/3500-2350-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/3500-2347-0x000000000A200000-0x000000000A212000-memory.dmp

    Filesize

    72KB

  • memory/3500-2346-0x000000000A2D0000-0x000000000A3DA000-memory.dmp

    Filesize

    1.0MB

  • memory/3812-2366-0x0000000000BC0000-0x0000000000BFB000-memory.dmp

    Filesize

    236KB

  • memory/3944-160-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-172-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-162-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-156-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-154-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-152-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-150-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-147-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-177-0x0000000000400000-0x000000000080A000-memory.dmp

    Filesize

    4.0MB

  • memory/3944-148-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-146-0x0000000004D30000-0x0000000004D48000-memory.dmp

    Filesize

    96KB

  • memory/3944-143-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/3944-179-0x0000000000400000-0x000000000080A000-memory.dmp

    Filesize

    4.0MB

  • memory/3944-145-0x0000000004D80000-0x000000000527E000-memory.dmp

    Filesize

    5.0MB

  • memory/3944-144-0x0000000002510000-0x000000000252A000-memory.dmp

    Filesize

    104KB

  • memory/3944-158-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-166-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-176-0x0000000004D70000-0x0000000004D80000-memory.dmp

    Filesize

    64KB

  • memory/3944-175-0x0000000004D70000-0x0000000004D80000-memory.dmp

    Filesize

    64KB

  • memory/3944-174-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-168-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-170-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/3944-164-0x0000000004D30000-0x0000000004D42000-memory.dmp

    Filesize

    72KB

  • memory/4260-2351-0x0000000004B90000-0x0000000004BA0000-memory.dmp

    Filesize

    64KB

  • memory/4260-2355-0x0000000005FA0000-0x0000000006162000-memory.dmp

    Filesize

    1.8MB

  • memory/4260-2356-0x0000000007F20000-0x000000000844C000-memory.dmp

    Filesize

    5.2MB

  • memory/4260-2349-0x0000000004C20000-0x0000000004C6B000-memory.dmp

    Filesize

    300KB

  • memory/4260-2348-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

    Filesize

    248KB

  • memory/4260-2359-0x0000000004B90000-0x0000000004BA0000-memory.dmp

    Filesize

    64KB

  • memory/4260-2345-0x00000000051B0000-0x00000000057B6000-memory.dmp

    Filesize

    6.0MB

  • memory/4260-2342-0x0000000002480000-0x0000000002486000-memory.dmp

    Filesize

    24KB

  • memory/4260-2338-0x0000000000260000-0x000000000028E000-memory.dmp

    Filesize

    184KB